Hand of Thief, a new Linux virus

Just two weeks after reporting about the commercialization of the KINS banking Trojan, RSA reveals yet another weapon to be used in a cybercriminal’s arsenal.
It appears that a Russia based cybercrime team has set its sights on offering a new banking Trojan targeting the Linux operating system. This appears to be a commercial operation, which includes support/sales agents and software developer(s).

 

 

Meet the “Hand of Thief” Trojan

Hand of Thief is a Trojan designed to steal information from machines running the Linux OS. This malware is currently offered for sale in closed cybercrime communities for $2,000 USD (€1,500 EUR) with free updates.  The current functionality includes form grabbers and backdoor capabilities, however, it’s expected that the Trojan will have a new suite of web injections and graduate to become full-blown banking malware in the very near future. At that point, the price is expected to rise to $3,000 USD (€2,250 EUR), plus a hefty $550 per major version release. These prices coincide with those quoted by developers who released similar malware for the Windows OS, which would make Hand of Thief relatively priced way above market value considering the relatively small user base of Linux.
The Trojan’s developer claims it has been tested on 15 different Linux desktop distributions, including Ubuntu Fedora and Debian. As for desktop environments, the malware supports 8 different environments, including Gnome and Kde.

An Insider’s Glimpse

RSA researchers have managed to obtain the malware builder as well as the server side source code, and a preliminary analysis reveals familiar functionalities of a banking Trojan. Some of the initial features include:

• Form grabber for both HTTP and HTTPS sessions; supported browsers include Firefox, Google Chrome, as well as several other Linux-only browsers, such as Chromium, Aurora and Ice Weasel.
• Block list preventing access to specified hosts (a similar deployment used by the Citadel Trojan to isolate bots from security updates and anti-virus providers)
• Backdoor, backconnect and SOCKS5 proxy
• Anti-research tool box, which includes anti VM, anti-sandbox and anti-debugger

Figure 1: Hand of Thief – Linux Trojan’s Builder

Control Panel Features

The developer wrote a basic administration panel for the Trojan, allowing the botmaster to control the infected machines reporting to it. The panel shows a list of the bots, provides a querying interface, and run of the mill bot management options.
The Trojan’s infrastructure collects the stolen credentials and stores the information in a MySQL database. Captured data includes information such as timestamp, user agent, website visited and POST data. Hand of Thief also exhibits cookie-stealing functionality.

Figure 2: Hand of Thief – Linux Trojan’s Admin Panel View

Although Hand of Thief comes to the underground at a time when commercial Trojans are high in demand, writing malware for the Linux OS is uncommon, and for good reason. In comparison to Windows, Linux’s user base is smaller, considerably reducing the number of potential victims and thereby the potential fraud gains. Secondly, since Linux is open source, vulnerabilities are patched relatively quickly by the community of users. Backing this up is the fact that there aren’t significant exploit packs targeting the platform. In fact, in a conversation with the malware’s sales agent, he himself suggested using email and social engineering as the infection vector.

So What’s Next?

We are left with a number of questions:
Without the ability to spread the malware as widely as on the Windows platform, the price tag seems hefty, and raises the question – will the Linux Trojan have the same value as its Windows counterparts?
Also, with recent recommendations to leave the supposedly insecure Windows OS for the safer Linux distributions, does Hand of Thief represent the early signs of Linux becoming less secure as cybercrime migrates to the platform?
Only time will tell. RSA researchers will continue to closely monitor the development of this Trojan and update accordingly.

US Department of Energy is hacked again

The US Department of Energy has again been hacked, having previously fallen to an attack this February.
The DoE is notifying employees that hackers have gained personal information on 14,000 current and former staff, with the data including names and social security numbers.
The hack is said to have taken place late last month, and those affected are being warned about the potential danger of identity theft with their personal information now in the wild. The previous hack also involved the theft of personal data and affected several hundred staff.
The Wall Street Journal reports the attackers were able to get into the DoE systems by hacking into a human resources system, which included payroll data.
The SANS Institute, a cyber security research organisation, said such attacks can see hackers collect personal information to try and control sensitive US networked infrastructures, like that of the DoE, through compromised log-ins and passwords.
A hacker for instance, could use the personal information of an employee to try and get a new network or database password from the IT department.
In a memo confirming the attack, the DoE said, "No classified data was targeted or compromised. Once the full nature and extent of this incident is known, the Department will implement a full remediation plan."
The DoE said it will be paying the costs of identity theft protection to those affected by the data loss.

Scottish Independence: Yes ‘email hacking’ details

An email at the centre of a hacking inquiry within the official pro-independence campaign concerned payment to an academic for writing a newspaper article.

Yes Scotland filed a police complaint after private emails were allegedly accessed. It became aware after it received a media inquiry last week that appeared to contain information from internal correspondence.
The details of the email in question were not initially released but Yes Scotland revealed it was a correspondence with Dr Elliot Bulmer in connection with an article he wrote for the Herald newspaper titled, ‘a Scottish constitution to serve the common weal’.
The pro-independence group said it had no influence over what he wrote and revealed the details of the email to end “unhelpful speculation”.
A Yes Scotland spokesman said: “This matter was first brought to our attention last Wednesday when we were asked for comment on Dr Bulmer and the article in question. We responded quickly, confirming that a small fee had been paid to Dr Bulmer at his request. We were perfectly relaxed and transparent about this.
Legal advice
“However, later that day it became apparent that an email account at Yes Scotland had been accessed illegally and that the information relating to this matter had been gleaned as a result.
“We alerted the police and British Telecom as well as the enquirer who, upon reflection, decided to not proceed further.
“Given that the illegal breach of Yes Scotland email has become the subject of an extensive and ongoing police inquiry involving detectives from Police Scotland’s Digital Forensics Unit, we have - under legal advice and at the request of the investigating officers - been unable to discuss the content of the email relating to Dr Bulmer.
“However, given persistent unhelpful speculation, we can confirm that in the course of a wide-ranging discussion with Dr Bulmer it was suggested that he, as an academic working in a private capacity, might consider writing an article on matters about constitutional frameworks based on his expertise.
“At his request, he was paid a nominal fee for the considerable time and effort he spent on it. We had no input to, or any influence over, what he wrote.
“We would now ask that this serious criminal investigation is allowed to continue unhindered by further unhelpful speculation, accusation and misinformation.”

NSA unlawfully gathered domestic emails

The National Security Agency (NSA) illegally intercepted thousands of e-mails from Americans with no connection to terrorism and misled the court about the scope of what it was doing, according to latest declassified documents.

Officials disclosed the history of that unlawful surveillance, releasing three partially redacted opinions of the Foreign Intelligence Surveillance Court that detailed the judges’ concerns about how the NSA had been siphoning data from the Internet in an effort to collect foreign intelligence.

The documents were released in response to a Freedom of Information Act lawsuit filed by the Electronic Frontier Foundation, an advocacy group based in San Francisco.

According to a redacted 85-page opinion by the chief judge of the Foreign Intelligence Surveillance Court, the National Security Agency (NSA) may have been collecting as many as 56,000 “wholly domestic” communications each year.

“For the first time, the government has now advised the court that the volume and nature of the information it has been collecting is fundamentally different from what the court had been led to believe,” John D. Bates, the then surveillance court’s chief judge wrote in his October 3, 2011 opinion.

U.S. intelligence officials sought to portray the matter as a technical glitch that the intelligence agencies caught and fixed.

But in the court opinion, judges said the NSA repeatedly had misled them about the scope of what it was doing.

“The court is troubled that the government’s revelations regarding NSA’s acquisition of Internet transactions mark the third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection programme,” Mr. Bates wrote.

The latest revelations come amid growing criticism from members of Congress and privacy groups about the NSA surveillance programs and charges that the agency has far overstepped its bounds in collecting information on U.S. citizens.

In a late night statement, the Office of the Director of National Intelligence (ODNI) strongly refuted media reports that the U.S. has unfettered access to some 75 per cent of the country’s online communication.

“The reports leave readers with the impression that NSA is sifting through as much as 75 per cent of the United States’ online communications, which is simply not true. In its foreign intelligence mission, and using all its authorities, NSA “touches” about 1.6 per cent, and analysts only look at 0.00004 per cent, of the world’s Internet traffic,” ODNI said.